Executive brief
The Linux kernel's register map driver for SoundWire devices contains a null pointer dereference vulnerability in the busy-polling logic. When certain audio codec devices respond to commands in a specific way, the kernel crashes instead of handling the response gracefully. This causes system instability or denial of service on affected devices.
Technical details
A null pointer dereference occurs in regmap_sdw_mbq_poll_busy() when it unconditionally calls ctx->readable_reg(), a callback that is optional and may be NULL. The vulnerable code path is triggered following commit ca1b11b36d82, which caused polling to run on every -ENODATA error, not only on driver-marked deferrable controls. Devices such as es9356 and tac5xx2-sdw do not set this callback, and when they return COMMAND_IGNORED, the kernel dereferences a NULL function pointer. The fix adds a NULL check before invoking the callback, treating a missing callback as "poll anyway" per regmap convention. Attack vector requires local access or ability to trigger the affected code path through audio device interaction.
Affected products
- Linux Linux kernel 5.0 and later (exact range varies by stable branch)
Timeline
- 2026-08-26: disclosed
- 2026-08-12: patched